How To Hack A Porsche Research Muffled

The Syrian Electronic Army: 9 Things We Know

A British high court has banned the publication of an academic paper set to detail exploitable vulnerabilities in a car-immobilizer system that dates from the late 1990s, which remains widely used in Audi, Bentley, Lamborghini, Porsche and Volkswagen cars, among other vehicles.

The three computer scientists who discovered the flaws, which relate to the Megamos Crypto algorithm that's used to verify the authenticity of a car-ignition key, were set to detail those vulnerabilities at an information security conference next month in Washington. They said they found a software program on the Internet, publicly available since 2009, that included the algorithm, which was created by French security group Thales.

After the High Court of Justice of England and Wales blocked the publication of their paper, however, the researchers -- Baris Ege and Roel Verdult, information security researchers at Radboud University Nijmegen in the Netherlands, and Flavio Garcia, a computer science lecturer at Britain's University of Birmingham -- this week said they would abide by the decision.

[ Auto makers envision cars that are more connected to the cloud. Read 5 Ways Big Data Can Improve Your Car. ]

Although the court-ordered publishing ban was handed down on June 30, it gained little attention until Britain's Guardian detailed the high court's ruling Tuesday. That triggered a furious public debate over whether the publication ban served the public's best interests.

The ban was requested by Thales and Volkswagen, which originally developed the Megamos Crypto system. The system involves a radio-frequency identification (RFID) transponder, built into car keys, which can be used to transmit an encrypted signal to a vehicle and disable its immobilizer. Unless disabled, the immobilizer prevents a car's engine from starting. The system is now used in cars sold by Cadillac, Honda, Mercedes, Mazda, Nissan, Toyota and Volvo cars, among many other automakers.

Volkswagen told the court that publishing information on the system could "allow someone, especially a sophisticated criminal gang with the right tools, to break the security and steal a car," reported the Guardian. The automaker also argued that the algorithm used to disable the car's immobilizer was confidential information. But Radboud University Nijmegen has expressed frustration with the legal action and delays by Volkswagen and Thales over the "outdated" chip, despite their having been notified of the vulnerability some time ago.

"The researchers informed the chipmaker nine months before the intended publication ... so that measures could be taken," said a statement released Monday by the university. "The Dutch government considers six months to be a reasonable notification period for responsible disclosure. The researchers have insisted from the start that the chipmaker inform its own clients."

The researchers said they obtained all of the information in their paper from the public domain, meaning no significant obstacle would face anyone else who wants to find exploitable vulnerabilities in the immobilizers. "The paper reveals inherent weaknesses, on the basis of mathematical calculations, and is based on an analysis of publicly available information," said Radboud University Nijmegen. "The publication in no way describes how to easily steal a car, as additional and different information is needed for this to be possible."

Furthermore, the researchers said that exploiting the weaknesses they've identified wouldn't exactly be practical. An attacker would have to run a software program that would take, on average, two days to identify a working crypto crack. The software would need to be run fresh for every different immobilizer targeted.

Their talk, "Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer," is still listed on the website for this year's USENIX Security Symposium, to be held next month, although as of Tuesday it was labeled as being "presentation only," suggesting that the researchers will no longer demonstrate a working exploit of the vulnerability.

A spokeswoman for Volkswagen didn't immediately respond to an emailed request for comment about how the automobile manufacturer planned to mitigate the vulnerabilities identified in the Megamos Crypto system, or what might be required to correct the vulnerability in any vehicle with such a system.

It was unclear whether an English court's ban on publication would extend to a conference in the United States, but by Monday both of the institutions involved said their researchers would refrain from publishing their paper. "The University of Birmingham is disappointed with the judgment which did not uphold the defense of academic freedom and public interest, but respects the decision," said a spokeswoman via email, reported the BBC.

The researchers had argued that their right to publish their paper was protected by the European Convention on Human Rights, which includes freedom of speech protections by which Britain has agreed to abide. But the High Court judge nevertheless imposed an injunction, pending a full trial.

Attorney Tom Ohta at British law firm Bristows told the BBC that the manner in which the researchers had obtained the cryptographic details has so far proved to be their legal undoing. "An important factor here was that the academics had not obtained the software from a legitimate source, having downloaded it from an unauthorized website," he said. "This persuaded the court that the underlying algorithm was confidential in nature, and bearing in mind the public interest of not having security flaws potentially abused by criminal gangs, led to the injunction."

Despite that setback, this is far from the first time that computer scientists have set their sights on hacking car systems and detailing related flaws in a research paper. In 2010, for example, a team from Rutgers University demonstrated how tire pressure sensors in some cars could be remotely spoofed.

That research was followed by a group of Swiss scientists who successfully deactivated car immobilizers, unlocked doors and started engines by using wireless repeaters to amplify the signal from a wireless key fob from a target's home to their car.